You log into a site. A small bar appears at the top of the browser — "Save password?" You click yes. Next time you visit, your credentials are filled in automatically. Problem solved.
Except it isn't a solution. It's a convenience feature wearing a solution's clothing.
Browser-saved passwords and a dedicated password manager look similar from the outside — both remember your passwords, both fill them in automatically. But underneath, they work completely differently. One stores your passwords behind a dedicated security layer you control. The other stores them in a way that's far more exposed than most people realize.
When Chrome, Safari, Firefox, or Edge saves your password, it stores it in a file on your device tied to your browser profile. That file is accessible to the browser — and to anything else that can reach it.
There is no master password required to access saved passwords in most browsers. If someone sits down at your unlocked computer, they can open browser settings and read your saved passwords in plain text. No additional authentication. No barrier. Just a list.
More importantly, every browser extension you've installed has varying degrees of access to what your browser sees and does. A poorly built extension — or a malicious one disguised as something useful — can reach your saved credentials without you ever knowing. Extensions that seemed legitimate when you installed them get sold, updated with new code, and repurposed. The permission you granted to a tab manager two years ago may now belong to someone with different intentions.
Browser extensions are the most overlooked attack surface most people have. An extension that can "read and change all your data on websites" can see your passwords as you type them — whether your browser saves them or not.
Every major browser now syncs your saved passwords across your devices. Chrome syncs to your Google account. Safari syncs to iCloud. Firefox syncs to a Mozilla account. Edge syncs to your Microsoft account.
This is marketed as a feature — your passwords everywhere, instantly. And the convenience is real. But what it means in practice is that your passwords are stored on someone else's server, tied to an account that for most people is protected by a reused password and no two-factor authentication.
It's the same pattern as the front-facing camera in newer cars that recognizes your face to load your seat position and mirror settings. Useful feature. What it actually is: a camera pointed at you every time you get in the car, connected to a system that stores biometric data you didn't think twice about handing over. The convenience obscures what you're trading.
Browser sync works the same way. You're not just saving passwords locally anymore. You're depositing them into an account at a company whose primary business is not security.
Your passwords are only as safe as the account they're synced to. For most people, that account has the same password as three other things.
The thing a browser password system doesn't have — and a real password manager does — is a dedicated security layer that exists for this purpose alone.
A password manager encrypts your vault with a master password that only you know. The company that makes the software cannot read your passwords. An extension with broad browser permissions cannot reach them. Someone sitting at your unlocked computer cannot open a settings page and read them in plain text.
The difference isn't cosmetic. It's architectural. One was built to store passwords securely. The other was built to make browsing more convenient and added password saving as a feature.
Before you move to a password manager, it's worth knowing what your browser has already collected. Open your browser settings and find the saved passwords section. Most people are surprised by the list — accounts they forgot they had, old passwords that should have been changed years ago, credentials for things they no longer use.
That list is a useful starting point. When you move to a password manager, those saved credentials come with you — and you can start replacing the weak ones one at a time.
The next step is understanding what a real password manager actually does and how to pick one that fits how you work.